External Links

(Note: CBC does not endorse and is not responsible for the content of external links.)

A whistleblower in the auto sales industry says car dealers may be violating customers' privacy rights when they take a test drive.

Kurtis Lemon says he quit his job as a salesman at Dueck GM’s Marine Drive location in Vancouver because he wasn't comfortable following a new procedure to scan customers’ licences.

This machine is used to scan drivers' licences at Dueck GM car dealership on Marine Drive in Vancouver. (Kurtis Lemon)

The 27-year-old says car dealers are collecting customers’ information, including their addresses and birthdates under the guise of needing it for a test drive, when what they are really doing is building a database for marketing purposes.

"I think it’s wrong because the car dealerships are still running off of the 70s and 80s models," said Lemon, referring to what he perceives as outdated sales practices.

Lemon says Dueck GM scans drivers’ licence data and imports it directly into a new software program called DealerMine, a customer relationship management or CRM tool, that helps dealers track and market to customers.

According to DealerMine's website, it can "track leads, enforce your sales process and measure the effectiveness of your team," and help dealers "market to customers that are ready to purchase and connect with them any way you choose."

"These new photo licence scanners are taking that info and they are directly taking the address and the height and age and all that info and putting it right into the CRM utility tool," said Lemon.

Kurtis Lemon quit his job at Dueck GM because he says he was not comfortable with scanning customers’ licences. (CBC)

"So the customer thinks, 'I needed a copy for their test drive.' But really, I am capturing all this information so I can start marketing to the customer and make a sale."

Lemon says Dueck's new licence scanner also copies information from both sides of the licence or card, which in the case of B.C.'s combined Services Card, includes personal health numbers.

"As a sales person, later on I can go find out which drivers’ licences were scanned and then pick my customer and start adding personal information."

"By law, we have to scan it, but after 30 days, we have to destroy the form," the salesman said, referring to a consent form which he mentioned but never produced.

Before a second test drive at Dueck in Richmond, another salesman photocopied a CBC journalist's licence and is recorded on hidden camera saying, "I'm supposed to use the scanner but... I photocopy, I'm old school."

He explained why they scan now, saying, "Basically, what it does is it uploads your info into our new kind of tracking software system. Not physically tracking, just to keep a database of customers."

At six different dealerships, salespeople told CBC journalists they needed a copy of a driver’s licence prior to a test drive for insurance purposes.

None explicitly asked for permission to keep personal information in a customer database.

The Insurance Corporation of British Columbia (ICBC) confirmed there is no insurance requirement for a dealership to photocopy or scan the driver’s licence of a customer test driving their vehicles.

‘The law is very clear’

B.C.'s information and privacy commissioner, Elizabeth Denham, was frustrated to hear the results of CBC's investigation and said dealers are not allowed to store and use customer data without their consent.

‘Shocking for consumers’

Vonn advises consumers not to allow anyone to walk away with their ID. "Photocopying and scanning a driver’s licence is just virtually never allowable under that legislation," she said.

"When you a check a licence, it's very different than saying, ‘We’re going to capture that data, we’re gonna mine the data and do things with data you never anticipated,'” said Vonn.

“That's obviously a breach of private sector privacy law, I think in that it's such a blatant dismissal of what has already been long decided.

“It's not a grey area. It should be a little bit shocking for consumers.”

She says the BCCLA will launch a formal complaint to B.C.'s information and privacy commissioner, who could then investigate the industry's practices.

‘Get you in the system’

The same make and model of driver's licence scanner used at Dueck was also spotted at other car dealerships at Richmond's auto mall.

A receptionist at Richport Ford was recorded on hidden camera complaining that her scanner needed an update because it "doesn't scan your driver’s licence properly. It puts the address in the name and the name in.... It's just easier if I just do it."

Scroll to the bottom of this story to see Haskins' full email statement

Haskins provided CBC with a copy of a consent form he says customers sign before all test drives, stating the customer agrees to allow Dueck to retain their name, address, email and phone number for “contact purposes.”

The form sent to us by Haskins specifies that the scanned copy of the driver's licence will be "auto deleted from our records within 30 days."

But at all five test drives we took at Dueck's three dealerships, CBC investigators were never asked to sign that consent form. Before one of these test drives, at Dueck on Marine Drive, the salesman did not ask to see a driver’s licence at all.

There was a waiver of liability form that was required to test drive at Dueck's downtown location, but it did not include anything about allowing Dueck to retain personal data for contact purposes or about auto deletion of this data after 30 days.

Haskins acknowledged that the company's consent form had been updated since he was approached by the CBC.

‘Protecting customers’ information’

Stu Haskins, vice-president of Dueck Auto Group, told CBC it is both "necessary" and "reasonable" to copy drivers’ licences. (Facebook/LinkedIn)

Haskins also writes that after 30 days, "the customer’s scanned or photocopied driver’s licence will be eliminated from the CRM system or destroyed.”

“What is retained, if agreed to by the customer, is name, address, email and mailing address," said Haskins.

"We are a firm believer in protecting customers’ information in accordance with the [Privacy] Act.

“It is our position that copying an individual's driver’s licence in advance of test driving one of our vehicles is reasonable, for legal, insurance, and security purposes.”

Haskins also said in response to our inquiry that Dueck has asked the New Car Dealers Association of B.C. to review this process with the information and privacy commissioner to ensure it is following the guidelines of the Privacy Act.

To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.

Note: The CBC does not necessarily endorse any of the views posted. By submitting your comments, you acknowledge that CBC has the right to reproduce, broadcast and publicize those comments or any part thereof in any manner whatsoever. Please note that comments are moderated and published according to our submission guidelines.